NTT DOCOMO confirms online-shop and My docomo data leakage affecting up to 300,000 records
DOCOMO’s third notice lists leaked identity-document numbers, subscription and tariff details among up to about 300,000 records; some also include bank-account, representative, employer or parenting-program information. Online Shop and My docomo procedures remain suspended; final scope, entry route and reopening remain unknown.
- Disclosed
- Nov 5, 2026
- Updated Nov 6, 2026
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Customers with information held by DOCOMO Online Shop or My docomo; exact affected records and fields are still being investigated
- NTT DOCOMO · Data breach · SaaS
- In the wild
- Yes
- DOCOMO confirms unauthorized access and customer-information leakage.
What happened
DOCOMO says it detected unauthorized access on November 4 and stopped procedures on its Online Shop and My docomo on November 5. Its second notice confirms customer-information leakage and lists names, addresses, birth dates, mobile numbers and contact telephone numbers among the fields. The estimate is a maximum of about 300,000 records, not a finalized victim count; details will be sent to affected customers.
The company says no new leakage has been identified since access was blocked, while investigation and maintenance continue. That is a containment observation, not recovery of stolen data. No intrusion route, CVE, completed remediation or restoration date is established. Do not infer that passwords or card information were taken, or that those categories have been ruled out. This concerns the named web services and does not establish an intrusion into every DOCOMO system or a cause for a separate mobile-network outage.
November 6 third notice: The list for all affected customers includes names, birth dates and ages; addresses, contact telephone numbers and emails; identity-document numbers; mobile numbers and contract-start dates; and tariff plans, options and discounts. Some customers additionally have legal/procedural representatives’ names and contacts, employer/corporate names and locations, bank names/branches/account numbers/account-holder names, or parenting-support program information exposed. These categories are not separate additive victim totals. The company retains the same approximate maximum and has not established the complete intrusion route or a reopening time. A bank-account number is not a bank-login password; the notice does not establish financial theft. If your banking fields were involved, contact your bank through its established channel about unexpected activity and appropriate monitoring.
Crime-scene timeline
Nov 4, 2026
DOCOMO confirms unauthorized external access
Its later notice identifies both the Online Shop and My docomo as affected.
Nov 5, 2026
Services halted and second notice confirms data leakage
Procedures on both services were stopped early that morning. The second notice estimates up to about 300,000 affected records; maintenance continues with no restoration estimate.
Nov 6, 2026
Third notice expands the confirmed field list
All affected customers have identity, contact and subscription fields listed; some also have bank-account, representative, employer or parenting-program information exposed. The maximum remains about 300,000 records, and maintenance has no restoration estimate.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- NTT DOCOMO second original incident noticePrimaryNovember 5 notice confirms external access, leakage up to about 300,000 records, example fields, continuing maintenance and pending scope/cause. It does not claim all DOCOMO services or customer accounts were breached.
- NTT DOCOMO third original incident noticePrimaryNovember 6 third notice, as of 18:00 Japan local time, gives the expanded field list and dedicated support line; maximum about 300,000 records, continuing maintenance, no newly identified leakage after access blocking.